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DETAILED ACTION 

Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set forth in 
37 CFR 1 .17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.1 14, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.1 14. Applicant's submission filed on 08 September 2009 has been entered. 

Response to Amendment 

2. Applicant's amendment filed 08 September 2009 cancels claims 1-41, and adds claims 
42-62. Applicant's amendment has been fully considered and entered. 

Response to Arguments 

3. In response to applicant's arguments against the references individually, one cannot show 
nonobviousness by attacking references individually where the rejections are based on 
combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re 
Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). 

Claim Rejections - 35 USC §103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 
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5. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 
(1966), that are applied for establishing a background for determining obviousness under 35 
U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating obviousness 
or nonobviousness. 

6. Claims 42-62 are rejected under 35 U.S.C. 103(a) as being unpatentable over Xie, U.S. 
Patent No. 6,772,347, in view of Balasubramanian, U.S. Publication No. 2005/0086206, and 
further in view of Chelsa, U.S. Publication No. 2004/0250124. Referring to claims 42, 47, 50-52, 
57, 60-62, Xie discloses a computer network firewall wherein initially denied packets are 
additionally filtered dynamically (Col. 5, lines 45-50 & Figure 6). The packets are initially 
denied based on counter rules that increment the count until a threshold is exceeded (Col. 5, lines 
10-15), which meets the limitation of receiving, by an intermediary device between a client and a 
server, a first message, rejecting, by the intermediary device, the first message based on a 
rejection rule that rejects messages. The dynamic filter, filters the initially denied packets using 
an additional set of rules, which are dynamically generated (Col. 5, lines 50-52), which meets the 
limitation of generating, by the intermediary device, an exception rule to the rejection rule 
responsive to the determination. The initially rejected packets, and later packets, can be allowed 
based on the newly generated rules used by the dynamic filter (Col. 5, lines 63-66), which meets 
the limitation of receiving, by the intermediary device, a second message, allowing, by the 
intermediary device, the second message to pass between the client and the server based on the 
exception rule. Xie discloses filtering packets using rules based on port number and IP address 
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(Col. 5, lines 58-60). The rules can be stored in a memory (Col. 4, lines 5-8), which meets the 
limitation of a trie structure, wherein each node in the trie is associated with a component. Xie 
does not specify filtering based on URLs and URL descendants. Balasubramanian discloses a 
rule based filtering system where URL requests are filtered at the domain and IP address level, 
based on rules, to allow/deny traffic for all domains beginning with identified IP address 
information ([0033] & [0056] & [0065]-[0067]), which meets the limitation of a first message 
having a first URL component comprising a plurality of hierarchically related URL components, 
the plurality of hierarchically related URL components comprising a first URL component and a 
second URL component, the second URL component being a descendant of the first URL 
component, the rejection rule rejecting message based on the messages comprising the first URL 
component, the exception rule allowing messages having the first URL component to pass, the 
exception rule is generated by inferencing a scalar data type of the descendants of the first URL 
component, the first URL component a hierarchical component of a directory path portion of an 
URL. It would have been obvious to one of ordinary skill in the art at the time the invention was 
made to dynamically filter the packets of Xie using domain and IP address rules, as taught in 
Balasubramanian, in order to control access to specific areas in web space as taught by 
Balasubramanian (0016]). Xie does not disclose dynamically generated rules when it is 
determined that packet denial is greater than a desired threshold amount. Chelsa discloses 
maintaining a frequency for the number of occurances with which messages were rejected 
([0017]), which meets the limitation of maintaining, by the intermediary device, a first number of 
occurrences of the first URL component in messages received by the intermediary device, 
maintaining, by the intermediary device, a second number of occurrences of the second URL 
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component in messages received by the intermediary device, determining, by the intermediary 
device, that a function of the first number of occurrences and the second number of occurrences 
exceeds a threshold, wherein the frequency is a function of a number of occurances with which a 
URL component and its descendants were rejected by a rule. It would have been obvious to one 
of ordinary skill in the art to dynamically generate exceptions for the dynamic filter of Xie based 
on a desired amount of allowable packets in order to minimize the blocking of legitimate traffic 
as taught be Chelsa ([0017]). 

Referring to claims 43, 53, Xie discloses that the packets are initially denied based on 
counter rules that increment the count until a threshold is exceeded (Col. 5, lines 10-15). Xie 
discloses filtering packets using rules based on port number and IP address (Col. 5, lines 58-60), 
but does not specify filtering based on URLs and URL descendants. Balasubramanian discloses a 
rule based filtering system where URL requests are filtered at the domain and IP address level, 
based on rules, to allow/deny traffic for all domains beginning with identified IP address 
information ([0056] & [0065]-[0067]), which meets the limitation of the first URL component in 
messages received, the first URL component having no descendents. It would have been obvious 
to one of ordinary skill in the art at the time the invention was made to dynamically filter the 
packets of Xie using domain and IP address rules, as taught in Balasubramanian, in order to 
control access to specific areas in web space as taught by Balasubramanian (0016]). Xie does not 
disclose dynamically generated rules when it is determined that packet denial is greater than a 
desired threshold amount. Chelsa discloses maintaining a frequency for the number of 
occurances with which messages were rejected ([0017]), which meets the limitation of the first 
number of occurrences of messages received exceeding the threshold, a number of occurrences 
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in messages received exceeding the threshold. It would have been obvious to one of ordinary 
skill in the art to dynamically generate exceptions for the dynamic filter of Xie based on a 
desired amount of allowable packets in order to minimize the blocking of legitimate traffic as 
taught be Chelsa ([0017]). 

Referring to claims 46, 56, Xie discloses that the packets are initially denied based on 
counter rules that increment the count until a threshold is exceeded (Col. 5, lines 10-15). The 
dynamic filter, filters the initially denied packets using an additional set of rules, which are 
dynamically generated (Col. 5, lines 50-52). Balasubramanian discloses a rule based filtering 
system where URL requests are filtered at the domain and IP address level, based on rules, to 
allow/deny traffic for all domains beginning with identified IP address information ([0056] & 
[0065]-[0067]). Xie does not disclose dynamically generated rules when it is determined that 
packet denial is greater than a desired threshold amount. It would have been obvious to one of 
ordinary skill in the art to dynamically generate exceptions for the dynamic filter of Xie based on 
a desired amount of allowable packets in order to minimize the blocking of legitimate traffic as 
taught be Chelsa ([0017]). This modified version of Xie would meet the limitation of the 
threshold as a product of a total number of messages over a time interval and a percentage of the 
messages that should be allowed. 

Referring to claims 44, 45, 48, 49, 54, 55, 58, 59, Xie discloses that the packets are 
initially denied based on counter rules that increment the count until a threshold is exceeded 
(Col. 5, lines 10-15), which meets the limitation of the frequency is a weighted/direct count of 
occurrences of the component. Xie discloses filtering packets using rules based on port number 
and IP address (Col. 5, lines 58-60), but does not specify filtering based on URLs and URL 
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descendants. Balasubramanian discloses a rule based filtering system where URL requests are 
filtered at the domain and IP address level, based on rules, to allow/deny traffic for all domains 
beginning with identified IP address information ([0056] & [0065]-[0067]), which meets the 
limitation of the function is a sum of at least the first number of occurrences and the second 
number of occurrences, the function as a function of the first number of occurrences and a 
number of occurrences of each descendant of the first URL component in messages received by 
the intermediary device, the function as a direct count of the occurrences of the first URL 
component, the function as a weighted count of the occurrences of the first URL component. It 
would have been obvious to one of ordinary skill in the art at the time the invention was made to 
dynamically filter the packets of Xie using domain and IP address rules, as taught in 
Balasubramanian, in order to control access to specific areas in web space as taught by 
Balasubramanian (0016]). 

Conclusion 

7. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to BENJAMIN E. LANIER whose telephone number is (571)272- 
3805. The examiner can normally be reached on M-Th 7:00am-5:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on 571-272-3799. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Benjamin E Lanier/ 

Primary Examiner, Art Unit 2432 



